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DEFINE! 

f ta_name ' count_pkts ' ; 
} 

select timestamp, hdr_length 

from IPV4 p 

where hdr length > 50 



FIG. 3 



DEFINE! 

f ta_name ' court t_pkts ' ; 
aggregate_slots '1'; 
} 

select timebucket, count (*) 
from IPV4 p 

group by timestamp/5000 AS timebucket 



FIG. 6 



DEFINE { 

fta_name ' count_pk:ts ' ; 
} 

select timestamp^ hdr_length, count(*), 

sum(offset), max(ttl), min(destIP} 
from IPV4 p 

where ttl m [ 2, 3, 6, 9 ] and 

timestamp > (TIMEVAL '123.45') + 5 
group by timestamp, hdr_length 
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^finclude 
#include 



" fta.h" 



The FT^ references the folloi^'-ing internal fens: 



struct count_pkts_fta{ 
struct FTA f; 

}; 

struct coun-_pkts_t jple{ 

struct ti^nsval tuple_varO; 
unsigned mt tuple_varl; 

}; 

;tatic mt f ree_f ta ( srruct FTA ^f){ 
return 0; 



static int control_fta{ struct FTA irt co-nrniand, int sz, 

struct court_pkts_fta * t = [strucL cc.un-c_pkts_f ta 



void *valje) { 



static mt accept_packet (struct FT^i struct packet *p) { 
Variables which are always needed */ 
int retva-Lr tuple_size, tuple_pos; 
struct count_pkts_tuple *tuple; 

struct count_picts_fta *t = [struct counz_pkT:s_fta-^ ) f; 

Variables for unpacking attributes */ 
unsignea int unpac/:_var_hdr_length_3; 
struct tmeval unpack_var_t imestamp__3 ; 



Unpack the referenced fields */ 
retval = get_ipv4_har_lengthip, &unpack_var_hdr_length_3 ) ; 
if(retvalf return 0; 

retval = cet_timestarnp (p, &unp5ck_var_timestamp_3 ) ; 
if!retval) return 0; 



Test the predicate 
±f[ t( { unpack_var_hcr_lergth_3>50 ) ) ) 
return 0; 

Create and post the tuple */ 
tuple_size = sizeof{ struct coun-z_pk-s_-uple] ; 
tuple~= allocate_tuple ;f r t->f -srream_id, tuple_size ); 
if ( tuple == NULL) 

return 0; 

tuple_pos = sizeof( struct coa-it_pkts_tuple ) ; 
tuole->tuple_varO = unp a ck_va retime stamp 3; 
tuple->tuple_varl = urpack_var_hdr_length_3; 
post_tuple [tuple ) ; 

return 0; 
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562 


struct FTA * count pkts_f ta_alloci'unsigned stream_id, un 


signed priority, int 


563 


argvc, void * argv[]){ 




554 


struct count_pkts_fta* f; 




565 
566 


if((f=fta alloc {O,sizeof (struct count_pk;ts_f ta 1) 


==0) { 


567 


returr ^ 0) ; 




568 


} 




569 






57 0 


f ->f . stream_id=stream_id; 




571 


f->f -prior ity=prior it: y; 




572 


f->f . alloc_fta=count_pkts_fta_alloc; 




573 


f->f . free_fta=free_fT:a; 




57 4 


f->f . con- rol_f ta=control_f ta ; 




575 


f->f .accGpt_Dacket=accept_pac^cet; 




576 






57 7 


return (struct FTA f; 




578 


} 





FIG. 5B 



o 

m 
o 



23 



2001-0227 



[701 
[702 

[703 

[704 
[705 

[706 



[707 



[708 



START J 



1 
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OUTPUT TUPLES FOR 
AGGREGATES BEING KICKED OUT 



SEARCH FOR AGGREGATE THAT 
MATCHES ON GROUP BY 
ATTRIBUTES 



MATCH FOUND? 



YES 



UPDATE AGGREGATES IN PLACE 
AND MOVE TO FRONT 



AGGREGATE LIST FULL? 
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#include "rts.h" 
^include "fta.h" 



The FTA references the following internal fens: 
Divide_Timeval_Int 

static s-ruct timeval Divide_Timeval_Int [ S" ruct tinpeval t, mt d>{ 
struct timeval r; 
r.tv__sec = t.tv_sec / d; 

r.tv_asec = (t.tv_jsec -r 1000- ( t.tv_sec % d )) / d; 
return { r ) ; 



struct count_pkts_aggr_struct{ 
struct timevai gb_varO; 
unsigned int aggr_varO; 
struct count_pkts_aggr__struct -^next; 

}; 

struct count_pkts_fta{ 
struct FTA f; 

struct count_pkts_aggr_struct *aggr_head; 

int n_aggrs; 

int max_aggrs; 

struct timeval last_gb_0; 

}f 

struct count_pkts_tuple{ 

struct timeval tuple_varO; 
ur signed int tuple_varl; 

}; 

static void fta_aggr_f lust {struct FT^ *f S { 

struct count_pkts_aggr_struG- *curr_aggr, ''-iext_aggr; 
mt tuple_size; 

struct ccant_pkts_tuple *tuple; 

struct cojnt_pkts_fta - t = (strict court_pkts_f ta *) f; 

curr_aggr = t->aggr__nead; 
while (curr_aggr '= NULL) ( 

next__aggr = curr_aggr->next; 

Create an cJtpjt tuple for the aggregate oeing kickec out 
-cuple_size = sizeoff s-ruct count_pkts_tup-e] ; 
-uple = allocate_tuple [ f ,t->f .3tream_id, tuple_size 
if; tuple NULL) { 

tupLe_pos = sizeof( strucu count_pkts__tuple j , 
tuple->tuple__varO = curr_aggr->gb_varO; 
tuple->tuple_varl = curr_aggr->aggr_vara ; 
posu_tuple (tuple) ; 

} 

fta_f ree (f,curr_aggr) ; 
curr^agcr = next_agcr; 

] 

t->n_aggrs = 0; 
t->aggr_head = NULL; 



FIG. 8A 
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mt free^fta 1 struc- ?TA *f){ 
fta__aggr_f lush [ ) ; 
return 0; 



static nt contrcl_fta (struct FT^ ^f, znt command, mt sZr void -^value)! 
struct cobnt_pk~s_f ta * z = [struct court_pkts_^f ta ) f; 

if (command == FTA_COHMAND_FLUSH ) 

fta_aggr_f lush( ) ; 
return 0; 

} 

static int accept_packet (struct FTA ''e, struct packet '^pM 
/* Variables which are always needed */ 

mt ref^al, tuple_size^ ruple^pos; 

struct counr._pkts_tuple *tuple; 

struct coum:_pkts_f ta *t = (struct count_pkzs_fta'^ > f; 

Variables for unpacking attrioutes 
struct timeval unpack_var_tiinGstamp_3; 



/*■ Variables for aggregation */ 

Group-by attributes f 
struct timeval gb_attr_0; 

/■*^ Variables for manipulating the aggregate list 

struct count_pfcts_aggr_strLct *curr__aggr, ''prev_aggr; 

Unpack tne referenced fields */ 
retval = ge-_timestamp [p, &unpack_var__times-arnp_3) ; 
iftretval) return 0; 



(no predicate to test) */ 

Search for an aggregate that rpatches on the group by attributes 
gb_attr_0 = Divide_Timeval_Int ( anpack_var_timestamp_3, 5000 5; 

Plusn the aggregates if t^e temporal gb attrs have changed. */ 
iff m; [Corrpare_Timeval(t->iast_gb_0, gb_attr_0) == O) ) ) 
fta_aggr_f lush t ) ; 

curr_aggr = t->acgr_head; prev_aggr = NULL; 
while (curr_aggr ■= NULL) { 

if[ [Compare_Timeval [gb_attr_0^ curr_aggr->gb_varO) ==0) ) 
break; 

If ( curr_agcr->next '= NJLL) 

prev_aggr = curr_aggr; 
curr_aggr = curr_aggr->next; 



FIG. 8B 
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if{curr_aggr NULL! { 

Match fourd : upda-ce in place, move to front. '^Z 
curr_accr->aggr_varO++; 

iftprev_aggr '= MULL 1 

prev_aggr->rext = curr_aggr->next ; 
if { t->aggr_head '= curr_agg-) 

curr__aggr->nex-:: = ■L->aggr_head; 
t->agg!:_head = curr_aggr; 

Jelsef 

No -natch found */ 
if (t->n_aggrs == t->max_aggrs) { 
/* And the aggregate list is full. Reclaim from the end. */ 

if(prev_aggr '= NULL] 

curr_aggr = prev_aggr->next ; 
else curr__aggr = t->aggr_bead; 
if (prev_aggr t= NULL) 

prev_aggr->next ~ curr_aggr->next ; 
if {t->aggr_head '= curr_aggr) curr_aggr->ne>ct = t->aggr_head; 
t->aggr__head = curr_aggr; 



Create an output tuple for the aggregate be_ng kicked out ■*"/ 
tuple_SLze = sizeof( struct count_pkts_taol e ) ; 
tuple = allocate_i:uple ( f , t->f . stream__id, tuple_size ); 
if ( tuple '= HULL) { 

tuple_pos - sizeof( struct count_pkts_tuple ) ; 

tuple->tuple_varO = cL.rr_aggr->gb__varO; 

tuple->ruple_varl - curr_aggr->aggr_varO; 

post_tupie (tuple ) ; 

} 

}elsei 

Room m the aggrega-e list^ add another olock. */ 
curr_aggr = (struct count_p■^ts_aggr_struct ) 
__alloc ( f , sizeof i.srruct count_pkts_aggr_struct ) ); 

if[curr_agcr ~ NULL) return (0); 
curr_acgr->next = ■c->aggr_heaG/ 
t->aggr_head = curr_aggr; 
t->n_aggrs--; 



curr_aggr->gb__varC = gb_attr_ 
curr_aggr->aggr_varO = 1; 
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ffmclude 
ff include 



_nQ mtenal fens: 



The FTPi references the follow 
Add_Tineval_Int 
Corrpare^Timeval 
Subtract_Timeval_Tineval 
T"imeval Constructor 



static struct timeval Add_Tirreval_Int ; struct timeval int inc] { 
struct tmeval r; 

r.tv__usec = t.tv_usec + (mc % 1000); 
r.tv_sec = t-tv_sec + inc / 1000; 
If (r.tv^usec > 9 99) { 

r.tv_usec 1000; 

r.tv_sec++; 

} 

} 

static mt Compare_Tineval (Struct timeval "^1, struct timeval t2){ 

return( tl.tv_gec t2.tv_sec ? tl.tv^sec - t2.tv_sec : tl.tv_usec 
t2.tv usee ); 



static inn Subtract__Timeval_Tiineval (struct timeval tl, struct tirreval -21{ 
retumdOOO* ;tl.tv_sec - t2.tv_secj + (tl.tv_usec - t2.tv_usec| 1; 



static struct tmeval Time val_Constructor ( int 
struct timeval r; 
r.tv_sec = s; 
r.tv_usec = rr; 
return ( r ) ; 

} 

struct count_pk:ts_aggr_struct { 
Struct timeval gb^^^arO; 
unsigned mt gb_varl; 
unsigned mt aggr_varO; 
unsigned int aggr_varl; 
unsigned int aggr_var2; 
unsxgned mt aggr_var3; 



struct count_pkts_fta { 
struct FTA f; 

struc;: count_pkts_aggr_struct *aggr_headf 
int n_aggrs; 
mt max^aggrs; 

}; 

struct count_pkts_i: jple{ 

struct tineval tuple^varO; 
unsigned mt tuple_vgrl; 
unsigned mt 
unsigned mt 
unsigned mt 
unsigned mt 



mt m) { 



tuple_var2; 
tuple_var3; 
tuple_var4 ; 
tuple var5; 
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1101 


s t 
s a ic 






1102 




stiTiJct count pRts 3CGr struct ^cjirc riOf "*^nsxt rid# 








cutr nd ~ f~5'3<3gr head; 




J.1 4 




'.'hi 1 e ( Gu^r nd '= MjLL) { 




1105 




nsxt nd = curr nd— >nsxt; 




1106 




fta freed, curr nd); 




1107 




curr rc = next rc; 




1108 








1105 




retan 0; 




1110 


} 






1111 








1112 


static 


mt cortrol fta (struct FTA *f, int command, in- ST., void *value) { 




1113 




struct count p)i'ts_fta * t = [struct count pkta^fta *■ ) f; 




1114 




return 0; 




1115 


} 






1116 








1117 


static 


mt accGpt_pack;et ( struct FTA *f, struct packet ■''p/{ 




Ills 




Variables wuch are al'ivays needed 




1119 




in" ret'u-al, tuple size, tuple pos; 




1120 




struct count pkts_tupla *tuple; 




1121 




struct court pkts_fta *t = (struct court pkts_fta*l f; 




1122 








1123 




Variables for unpacking attributes 




1124 




unsigned mt unpacf^_var__destlp_3; 




1125 




unsigned mt unpack, var hdr_length_3; 




1126 




unsig'ied mt unpack var offset 3; 




1127 




Strjct tinisval unpack. var_ti-nestamp 3; 




112S 




unsigned int unpack_var_ttl_3; 




1129 
1130 


/* 


Variables for aggregation */ 




1131 


/* 


Group-JDy attrioutes */ 




1132 




struct timeval cb attr 0; 




1133 




unsignea mt gb attr_l; 




1134 








1135 




Variables for manipulating the aggregate list */ 




1136 




struct courit_p3ct5 aggr struct *curr aggr, ''prev aggr; 




1137 








1138 


/* 


Unpack the referenced fields / 




1139 




retval = get ip'^4 dest ipip, Sunpack var destIP 3W 




1140 




if(retval) return 0; 




1141 




rerval = get ipv4_hdr_length ( p, &unpack_var ndr lengt"i_3); 




1142 




if (retval) return 0; 




1143 




retval = get ipv4_of f set (p, &unpack_var_of f 3et_3) ; 




1144 




11 (retval) return 0; 




ll45 




retval — ger times ta;rp fp,- &unpack var timestamp 3) ; 




1146 




iff retval 1 return 0; 




1147 




retval = get_ipv4_ttl ip, Sunpack^var ttl 3); 




1148 




if [retval) return 0; 




1149 








1150 


/* 


Test predicate */ 




1151 




Iff '{ ( ( ( ( unpacK_var_ttl_3 == 2 ) 11 ( u'^pack_var_ttl_3 3 ) 


1 \ 


1152 


( urpack_var_tcl__3 5 ) ) j { upack_var_ttl_3 == 9 ) ) ) 




1153 


( Conpa 


re Tirr.eval (unpack__var_timestamp_3^ Add Timeval Int(Timeval Const ructor ( 12 3, 


1154 


450), 5 


) 5 >0 ) ) ) ) 




1155 




return 0; 




1135 
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/■* Search for an aggregate that mazcnes on the croup by a" tributes 

gb_attr_0 = unpacK_var_timesta]np__3; 
gb_a"i:r_l = L!npacic_var_hcir_lenctb_3; 
curr_aggr = t->acgr_nesd; prev_aggr = NULL; 
while ( carriage r '= NULL) { 

_f; [Compare_Timeval (go_attr_G, carr_aggr->gb_varO) == 0) 55 
(gb_attr_l curr_aggr->gb_var_l i ) 
brea<; 

if (curr_aggr->next '= NULLl 

prev_acgr = curr_aggr; 
Gurr_aggr = curr_agcr->rext ; 



if Ccurr_aggi: \~ NULL) { 
/* Match found : update m place, move to front. */ 

curr_aggr->aggr__varO++; 

curr_aggr->aggr_varl += urpack_var__of fset_3; 

curr_aggr->aggr_V£r2 = ( curr__agg->aggr_var2 >= unpack:_var_ttl 
cjrr aggr->aggr_var2 : unpacjc_var_ttl_3 ) ; 

curr_aggr->aggi:_var3 = ; C!jrr_agg->aggr__var3 <^ 
unp&ck_var_destl?_3 ? c-irr_aggr->aggr_var3 : unpack_var_destIP_3 ); 
if [prev_aggr '= NULL) 

prev_aggr">next = curr_aggr->next; 
if (t->acgr_head '= curr^aggr} 

curr_aggr->nexi: = t->aggr_head; 
t->aggr_head ~ curr_aggr; 



}else{ 



t->aggr_head ; 



fta_alloc(f , 



No rratch found ... */ 

if [t->n__aggrs == t->max_aggrs j { 

And the aggregate list is full. Reclaim froir the end. */ 
if ;prev_aggr '= NULL) 

curr_aggr = prev_aggr->nex'[i; 
else curr^aggr = t->aggr_head; 
if(prev_aggr '= NULL) 

prev_aggr->next = curr_aggr->nexi; 
if ; t->aggr_head cjrr_aggr) carr_3ggr->rext = 

t->aggr_head = curr^aggr; 

Create an outpur iiuple for the aggregate being <icked out */ 
tuple_size = siseoff struct coijnt_pkt3_tupls) ; 
■tuple ~ allocate_tuple ( f , t->f . stream_id, tuple_size ); 
if ( tuple '= NULL) { 

tuple^pos = sizeoft struct count__r>kts_tuple ) ; 

tuple->tuple_var0 = curr_aggr->gb_YarO; 

tuple->tuple__vari = curr_aggr->gb_varl ; 

tuple->tuple_var2 == curr__aggr->aggr_varO; 

tuple->tuple__var3 = curr_aggr->aggr_varl; 

tuple->tuple_var4 = curr__aggr->aggr_var2; 

tuple->tuple_var5 = curr_aggr->aggr_var3; 

post_tupl e I tupl e ) ; 

} 

}else{ 

Room m the aggregate list, add another block. ^/ 
curr_aggr = [struct count__pkts_aggr_struct 
sizeof f struct count_pkts_aggr__struct 'i ); 

if(curr_accr ==- NULL) return (01; 
curr_aggr->next = t->a9cr_heaa; 
t->aggr_head = curr_aggr; 
t->n_aggrs — ; 



curr_aggr->gb_varO = gb_attr_0; 
curr_aggr->gb_varl = go_attr_l; 
ciirr_aggr->aggr_varO = 1; 

curr_aggr->aggr_varl = unpack_\/ar_of f set_3; 
CL.rr__aggr->aggr_var2 = unpac<_var_ttl_3; 
curr_aggr->aggr_var3 = unpack_var_deotIP_3; 
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ilOl 


struct FTA * count_pkts_f ta_alloc ( unsigrea stream^id, unsicre 


z priority, int 


1102 


argvc, void acgv[]){ 




1103 


struct Gourt_?lcts_fta* f; 




llOi 






11C5 


if { {f=fta_alloc[0,sizeof (struct count_pkts_f ta J) )==0) { 




1106 


return ( 0) ; 




110^ 


} 




1108 


f->aggr_heaci = NULL; 




1109 


f->n_agq-£ = 0; 




1110 
1111 


f->max_aggrs = 1; 




1112 


f->f .stream_ld=st^ea^l_lG; 




1113 


f->f .prlo^lty=prlorlty; 




1114 


f->f . alloG_fta=coun-_pkts_fta_allcc; 




1115 


f->f - free_fta-free_fta; 




1116 


f->f. control fi:a=control_fta; 




1117 


f->f . accept_pacJcet=accept_pacicet:; 




1118 






1119 


return (struct FTA f; 




112C 


} 
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1201 


DEFINE { 




1202 


f ta_najne ' test_query ' ; 




1203 


} 




1204 






1205 


select hcir_length/ max ( str_f ind_substr (IPv4 


_header, 'bob') ), 


1206 


str find substr( mm {IPv4_header) 


, 'bob') 


1207 


from IPV4 p 




1208 


where precedence > 5 and IPv4_header > 




1209 


str_f±nd_substr (IPv4_data, 'host : 




1210 


group by hdr_length 





FIG. 12 



DEFINE { 

f ta_naine ' count_pkts ' ; 
inin_hdr_lerLgth ' mt ' ; 
} 

select timestampr hdr^length 
froiR IPV4 p 

where hdr__length > $rain_hdr_length 
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#inciUae "rts.h" 
if induce "fta.h" 



*/ 

struct 

}; 

struct 



The TTfl references tne following internal tens: 



count_pkts_f ta { 
struct FTA f; 

int param_mxn^hdr_length; 



count _pk ts_t jpl e { 

unsigned long long int tuple_varO; 
unsigned mt tuple__varl; 



void load_params (stract count_pkts_f ta *z, mt az, void ■*^value){ 
int pos=0; 
inr data_pos; 

data_pos ^ siz&of( irt ); 
if(data_pos > sz) return; 

■i:->para[r_min_hdr_length = t, (mt (char *)value+pos) ); 

pos += sizeof( mt ); 



} 

static 
} 

static 



mt f ree_fia (srruc- HTA *f; 
return 0; 



mt Gontrol_fta I s-ruct FTA. *'t, mt command, int sz, voic *value) { 
struct count_pk:t3__fta * t = (struct coLint_p)cts_f ta *) 

1 f { coTiTiand FTA_COMI-ia»N D_LOAD_PARAMS ) { 
load_params it, sz, value); 



iPt accepr__p£ckec (s-ruct FTA *f, srruct packet ''pit 

Variables which are always needed ^/ 
nt retval, tuple_size, tuple_pos; 
struct count_pk:ts_tuple *tuple; 

struct count_pi<:ts_f ta *t = (struct count_pkts_fta* ) f; 

Variables for unpacking attributes 
unsigned int unpack_var_hdr_length_3; 
unsigned long long int unpack_var_t imestamp_3; 



/* Lfnpack rhe referenced fields "/ 

retval = get_ipv4_hdr_length [p, &unpack_var_bdr_length_3) 
if [retval I return 0; 

retval = get_timestamp (p, Sunpack_var_ti/r!estainp__3) ; 
If (retval) return 0; 



static 
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Test the predicate */ 
If ( ! ( f unpack:__^/ar__hd^_lengtn_3>t->p^^a^_mln_hdr_le^gth 
return 0; 

Create and post the tuple 
tuple_3ize = sizeof( struct cou;nt_p}cts_tupleJ ; 
tuple = allocate__^uple [f ,i->f .stream_id, tuple_size 
if( cuple " NULL) 

return 0; 

tuple_pos = sizeof{ struct count_pk:ts_tupl9 ) ; 
tuple->tuple_varO = unpack_var_timestamp_3; 
tupie->tuplev£ri = unpack_var_hdr_lengLh_3; 
postal uple [tuple) ; 

return 0; 



struct FTA * ccunt__pkts_fta_alloc(unsicrec scream_ic;, unsigned pnorizy, int 
command, int sz, void * value) { 
struct count_pkts_f ta* f; 

if ( ( f=f ta alloc I Or sizeof I struct count pkcs_fta ) ) )==0} ^ 
return ( 0) ; 

} 

f->f . streain_id=stream_ia; 

f->f .prior ity^priority; 

f->f . alloc_fta=count_p<ts_fta_alloc; 

f->f .free_fta=free_fta; 

f->f ,co'-.trol_fta=control_f"ta; 

f ->f . 3ccept_packet=accept_packet; 

load_params ( f , sz^ value i; 

return [struct FTA *) f; 
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